This is just me putting in my formal objection to BIP148 and BIP149 based on my experience with the ETH/ETC hard fork and involvement in that drama.

First, it's important to note that ETC/ETH HF is a very different situation from BIP148 and all other soft-forks. To those on this mailing list, the reasons should be self-evident (one results in two incompatible chains, the other doesn't).

However, replay attacks are common to both possibilities (i.e. when BIP148 has <51% hash power).

I believe the severity of replay attacks is going unvoiced and is not understood within the bitcoin community because of their lack of experience with them.

I further believe that replay attacks are the #1 issue with BIP148, BIP149, etc., superseding wipeout attacks in severity.

These are not baseless beliefs, they're born out of experience and I think anyone will reach the same conclusion upon study.

In a nutshell, replay attacks mean that all talk of there being potentially "two coins" as a result of BIP148 is basically nonsense.

Replay attacks effectively eliminate that possibility.

When users go to "sell their legacy coins", they've just sold their 148 coins, and vice versa.

Both of the coin-splitting techniques given so far by the proponents BIP148 are also untenable:

- Double-spending to self with nLockTime txns is insanely complicated, risky, not guaranteed to work, extremely time consuming, and would likely result in a massive increase in backlogged transactions and increased fees.

- Mixing with 148 coinbase txns destroys fungibility.

Without a coin, there is no real threat from BIP148. Without that threat, there is no point to BIP148, and the miners know this.

These and other concerns are outlined and explained in more detail in this conversation I had yesterday with John Light:

http://youtu.be/33rL3-p8cPw

Cheers,Greg Slepak

--Please do not email me anything that you are not comfortable also sharing with the NSA.

Post by Tao Effect via bitcoin-devI believe the severity of replay attacks is going unvoiced and is notunderstood within the bitcoin community because of their lack of experiencewith them.

Please don't insult our community-- the issues with replay werepointed out by us to Ethereum in advance and were cited specificallyin prior hardfork discussions long before Ethereum started editingtheir ledger for the economic benefit of its centralizedadministrators.

The lack of extensive discussion on these issues you're seeing israther symptomatic of engineers that take stability seriously nottaking BIP148 seriously; not symptomatic of people not knowing aboutthem. The same concerns also applies to all these HF proposals (whichfor some reason you don't mention), arguably even stronger. The samebasic pattern exists: There are people that just don't care about thetechnical issues who have made up their minds, and so you don't seetechnical discussion. Those people who do see the issues alreadycalled out the proposals as being ill-advised. Replay isn't even thelargest of the technical issues (network partitioning, for example, isa much larger one).

BIP149 is arguably something of another matter in particular becauseit has a time-frame that allows dealing with replay and other issues--and particularly because it has a time-frame that can allow for theavoidance of a meaningful fork at all.

Maybe this is yet another example of a recurring criticism of Core: that core doesn't community these issues very well to journalists / reports / media / community outside of this list.

Because outside of this list it's been all about those 148 coins, and almost zero mention of replay attacks.

Post by Gregory Maxwell via bitcoin-devBIP149 is arguably something of another matter in particular becauseit has a time-frame that allows dealing with replay and other issues--and particularly because it has a time-frame that can allow for theavoidance of a meaningful fork at all.

Post by Tao Effect via bitcoin-devI believe the severity of replay attacks is going unvoiced and is notunderstood within the bitcoin community because of their lack of experiencewith them.

Please don't insult our community-- the issues with replay werepointed out by us to Ethereum in advance and were cited specificallyin prior hardfork discussions long before Ethereum started editingtheir ledger for the economic benefit of its centralizedadministrators.The lack of extensive discussion on these issues you're seeing israther symptomatic of engineers that take stability seriously nottaking BIP148 seriously; not symptomatic of people not knowing aboutthem. The same concerns also applies to all these HF proposals (whichfor some reason you don't mention), arguably even stronger. The samebasic pattern exists: There are people that just don't care about thetechnical issues who have made up their minds, and so you don't seetechnical discussion. Those people who do see the issues alreadycalled out the proposals as being ill-advised. Replay isn't even thelargest of the technical issues (network partitioning, for example, isa much larger one).BIP149 is arguably something of another matter in particular becauseit has a time-frame that allows dealing with replay and other issues--and particularly because it has a time-frame that can allow for theavoidance of a meaningful fork at all.

Please don't insult our community-- the issues with replay werepointed out by us to Ethereum in advance and were cited specificallyin prior hardfork discussions long before Ethereum started editingtheir ledger for the economic benefit of its centralizedadministrators.

Please don't spread misinformation. Whatever you think of the DAO hardfork, it's a simple fact that the Ethereum ledger was not edited.

Please don't spread misinformation. Whatever you think of the DAO hard fork, it's a simple fact that the Ethereum ledger was not edited.

This sort of email is unhelpful to this conversation, and it certainly doesn't help with the perception that Ethereum is nothing but a bunch of hypocritical Bankers 2.0.

Everyone knows you didn't edit Ethereum Classic, but the the hard fork, which was re-branded as Ethereum, was edited.

- Greg

--Please do not email me anything that you are not comfortable also sharing with the NSA.

On Tue, Jun 6, 2017 at 10:39 PM, Tao Effect via bitcoin-dev

Post by Tao Effect via bitcoin-devI believe the severity of replay attacks is going unvoiced and is notunderstood within the bitcoin community because of their lack of experiencewith them.

Please don't insult our community-- the issues with replay werepointed out by us to Ethereum in advance and were cited specificallyin prior hardfork discussions long before Ethereum started editingtheir ledger for the economic benefit of its centralizedadministrators.Please don't spread misinformation. Whatever you think of the DAO hard fork, it's a simple fact that the Ethereum ledger was not edited.-Nick Johnson

Post by Nick Johnson via bitcoin-devNick,Please don't spread misinformation. Whatever you think of the DAO hardfork, it's a simple fact that the Ethereum ledger was not edited.This sort of email is unhelpful to this conversation, and it certainlydoesn't help with the perception that Ethereum is nothing but a bunch ofhypocritical Bankers 2.0.Everyone knows you didn't edit Ethereum Classic, but the the hard fork,which was re-branded as Ethereum, was edited.

That's not what I was suggesting. My point is that the ledger was neveredited. An 'irregular state change' was added at a specific block height,but the ledger remains inviolate.

I'm sure I don't have to explain the difference between the ledger and thestate to you, or why it's significant that the ledger wasn't (and can't be,practically) modified.

-Nick

Post by Nick Johnson via bitcoin-dev- Greg--Please do not email me anything that you are not comfortable also sharing with the NSA.On Wed, Jun 7, 2017 at 12:02 AM Gregory Maxwell via bitcoin-dev <

Please don't insult our community-- the issues with replay werepointed out by us to Ethereum in advance and were cited specificallyin prior hardfork discussions long before Ethereum started editingtheir ledger for the economic benefit of its centralizedadministrators.

Please don't spread misinformation. Whatever you think of the DAO hardfork, it's a simple fact that the Ethereum ledger was not edited.-Nick Johnson

I don't normally post here, but I'm sorry, if you don't see those two asequal, then I think you have misunderstood the *entire* value propositionof cryptocurrencies.The state of any cryptocurrency should entirely (and only) be defined byits ledger. If the state of the system can be altered outside of the rulesgoverning its ledger, then the system isn't secure.

This is true of any blockchain: you can always change the rules with theconsent of the participants.

It doesn't matter whether the people making those changes are the onesthat are leading the project or not. An "irregular state change" is a fancyterm for a bailout.I'm sure I speak for more than myself in saying that an "irregular statechange" is equivalent to modifying the underlying ledger. Let's not letsemantics keep us from recognizing what actually took place.

It's not; modifying the ledger would rewrite history, erasing the record ofthe original transactions. That's a fundamentally different operation, bothtechnically and semantically.

Post by Nick Johnson via bitcoin-devNick,Please don't spread misinformation. Whatever you think of the DAO hardfork, it's a simple fact that the Ethereum ledger was not edited.This sort of email is unhelpful to this conversation, and it certainlydoesn't help with the perception that Ethereum is nothing but a bunch ofhypocritical Bankers 2.0.Everyone knows you didn't edit Ethereum Classic, but the the hard fork,which was re-branded as Ethereum, was edited.

That's not what I was suggesting. My point is that the ledger was neveredited. An 'irregular state change' was added at a specific block height,but the ledger remains inviolate.I'm sure I don't have to explain the difference between the ledger andthe state to you, or why it's significant that the ledger wasn't (and can'tbe, practically) modified.-Nick

Post by Nick Johnson via bitcoin-dev- Greg--Please do not email me anything that you are not comfortable also sharing with the NSA.On Wed, Jun 7, 2017 at 12:02 AM Gregory Maxwell via bitcoin-dev <

Please don't insult our community-- the issues with replay werepointed out by us to Ethereum in advance and were cited specificallyin prior hardfork discussions long before Ethereum started editingtheir ledger for the economic benefit of its centralizedadministrators.

Please don't spread misinformation. Whatever you think of the DAO hardfork, it's a simple fact that the Ethereum ledger was not edited.-Nick Johnson_______________________________________________

Post by Tao Effect via bitcoin-devI believe the severity of replay attacks is going unvoiced and is notunderstood within the bitcoin community because of their lack ofexperience with them.

Replay is a solved problem. It can be improved on and made simpler, but atthis point, replay only occurs when the sender is either negligent orintending it.

Post by Tao Effect via bitcoin-devBoth of the coin-splitting techniques given so far by the proponents BIP148- Double-spending to self with nLockTime txns is insanely complicated,risky, not guaranteed to work, extremely time consuming, and would likelyresult in a massive increase in backlogged transactions and increasedfees.

This is nothing but unfounded FUD. It is very simple to implement andguaranteed to work eventually. It may be time consuming, but that is the onlytruth here. The only risk is that of a long reorg, the same as double spendattacks.

What kind of "fungibility" does this FUD claim it destroys? Destroying cross-chain fungibility is the very *intent* of replay protection. And it does notdestroy same-chain fungibility any more than any other miner spending.

Lack of replay protection does not mean there is no coin. Replay protection isequally a concern for the main (BIP148) chain and any legacy chains maliciousminers might choose to split off. And none of this changes the fact that suchminers will be unable to sell their legacycoins at Bitcoin market prices,because whether other transactions are replayed or not, *their* coins won't bevalid on the main chain.

Post by Luke Dashjr via bitcoin-devThis is nothing but unfounded FUD. It is very simple to implement andguaranteed to work eventually. It may be time consuming, but that is the onlytruth here. The only risk is that of a long reorg, the same as double spendattacks.

Let's assume you invented a simple way to double-spend txns to self (which you haven't, fyi), then that is an issue in of itself as the point of bitcoin is to *prevent* double-spending to self.

There would need to be much more time for the community to discuss the implications of wallets have a "double-spend to self" button in them.

Post by Luke Dashjr via bitcoin-devWhat kind of "fungibility" does this FUD claim it destroys? Destroying cross-chain fungibility is the very *intent* of replay protection. And it does notdestroy same-chain fungibility any more than any other miner spending.

Yes it does destroy same-chain fungibility, as discussed on twitter [1], you're making miner coins special on both chains.

Post by Tao Effect via bitcoin-devI believe the severity of replay attacks is going unvoiced and is notunderstood within the bitcoin community because of their lack ofexperience with them.

Replay is a solved problem. It can be improved on and made simpler, but atthis point, replay only occurs when the sender is either negligent orintending it.

Post by Tao Effect via bitcoin-devBoth of the coin-splitting techniques given so far by the proponents BIP148- Double-spending to self with nLockTime txns is insanely complicated,risky, not guaranteed to work, extremely time consuming, and would likelyresult in a massive increase in backlogged transactions and increasedfees.

This is nothing but unfounded FUD. It is very simple to implement andguaranteed to work eventually. It may be time consuming, but that is the onlytruth here. The only risk is that of a long reorg, the same as double spendattacks.

What kind of "fungibility" does this FUD claim it destroys? Destroying cross-chain fungibility is the very *intent* of replay protection. And it does notdestroy same-chain fungibility any more than any other miner spending.

Lack of replay protection does not mean there is no coin. Replay protection isequally a concern for the main (BIP148) chain and any legacy chains maliciousminers might choose to split off. And none of this changes the fact that suchminers will be unable to sell their legacycoins at Bitcoin market prices,because whether other transactions are replayed or not, *their* coins won't bevalid on the main chain.Luke

CoinJoin works as a method of both improving fungibility and mixing withcoinbase transactions.

You probably don't need to do anything clever to split a coin though:if you send a transaction with a standard fee it will get confirmedin a normal time on the higher hashrate chain, but won't confirm asquickly on the lower hashrate chain (precisely because transactions arevalid on both chains, but blocks are found more slowly with the lowerhashrate). When it's confirmed on one chain, but not on the other, youcan then "double-spend" on the lower hashrate chain with a higher fee,to end up with different coins on both chains.

However, of the proposed methods, coin-mixing seems the better option, because it might be reasonably easy (I don't know) for exchanges to obtain 148 coinbase coins, and mix their coins with them, extending the coin-splitting capability beyond just miner coins and then using that to split incoming coins.

That seems like the most reasonable approach I've heard so far. Whether exchanges would be willing to do that is a separate question.

Post by Anthony Towns via bitcoin-devWhen it's confirmed on one chain, but not on the other, youcan then "double-spend" on the lower hashrate chain with a higher fee,to end up with different coins on both chains.

This method is time consuming and not guaranteed to work. CPFP can be used by an attacker to get your original txn into the 148 chain.

CoinJoin works as a method of both improving fungibility and mixing withcoinbase transactions.if you send a transaction with a standard fee it will get confirmedin a normal time on the higher hashrate chain, but won't confirm asquickly on the lower hashrate chain (precisely because transactions arevalid on both chains, but blocks are found more slowly with the lowerhashrate). When it's confirmed on one chain, but not on the other, youcan then "double-spend" on the lower hashrate chain with a higher fee,to end up with different coins on both chains.(also, no double-n in untenable)Cheers,aj_______________________________________________bitcoin-dev mailing listhttps://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

*err, my bad that's unlikely to happen, if I remember correctly CPFP can only be done by the person you're sending the coins to. Coin-mixing seems the better option of the two, but shouldn't the BIP148 folks wait until it's clear that will be supported by exchanges?

--Please do not email me anything that you are not comfortable also sharing with the NSA.

My understanding is that the two situations are quite different.Unlike mixing to coin-split, CoinJoin doesn't create a high demand exclusively for coinbase transactions.However, of the proposed methods, coin-mixing seems the better option, because it might be reasonably easy (I don't know) for exchanges to obtain 148 coinbase coins, and mix their coins with them, extending the coin-splitting capability beyond just miner coins and then using that to split incoming coins.That seems like the most reasonable approach I've heard so far. Whether exchanges would be willing to do that is a separate question.

Post by Anthony Towns via bitcoin-devWhen it's confirmed on one chain, but not on the other, youcan then "double-spend" on the lower hashrate chain with a higher fee,to end up with different coins on both chains.

This method is time consuming and not guaranteed to work. CPFP can be used by an attacker to get your original txn into the 148 chain.

However, of the proposed methods, coin-mixing seems the better option, because it might be reasonably easy (I don't know) for exchanges to obtain 148 coinbase coins, and mix their coins with them, extending the coin-splitting capability beyond just miner coins and then using that to split incoming coins.

That seems like the most reasonable approach I've heard so far. Whether exchanges would be willing to do that is a separate question.

When it's confirmed on one chain, but not on the other, youcan then "double-spend" on the lower hashrate chain with a higher fee,to end up with different coins on both chains.

This method is time consuming and not guaranteed to work. CPFP can be used by an attacker to get your original txn into the 148 chain.

(also, no double-n in untenable)

Why thank you aj, you're so good at spelling. :-)

Cheers,Greg

--Please do not email me anything that you are not comfortable also sharing with the NSA.

CoinJoin works as a method of both improving fungibility and mixing withcoinbase transactions.

You probably don't need to do anything clever to split a coin though:if you send a transaction with a standard fee it will get confirmedin a normal time on the higher hashrate chain, but won't confirm asquickly on the lower hashrate chain (precisely because transactions arevalid on both chains, but blocks are found more slowly with the lowerhashrate). When it's confirmed on one chain, but not on the other, youcan then "double-spend" on the lower hashrate chain with a higher fee,to end up with different coins on both chains.

Post by Kekcoin via bitcoin-devYou keep referring to 148 coinbase coins, what is the rationale behind this? Why would you prefer using 148 coinbases over legacy coinbases for this purpose?

OK, maybe "post-UASF coinbase coins" is a better term? I just wanted to make it clear that this refers to coins that come from blocks generated after the UASF is activated.

--Please do not email me anything that you are not comfortable also sharing with the NSA.

Post by Kekcoin via bitcoin-devYou keep referring to 148 coinbase coins, what is the rationale behind this? Why would you prefer using 148 coinbases over legacy coinbases for this purpose?Sent with ProtonMail <https://protonmail.com/> Secure Email.

Hmm, that's not the difference I was talking about. I was referring to the fact that using "post-chainsplit coinbases from the non-148 chain" to unilaterally (ie. can be done without action on the 148-chain) taint coins is more secure in extreme-adverserial cases such as secret-mining reorg attacks (as unfeasibly expensive they may be); the only large-scale (>100 block) reorganization the non-148 chain faces should be a resolution of the chainsplit and therefore render the replay threat moot.

If you don't have replay protection, replay is always a threat. A very serious one.

--Please do not email me anything that you are not comfortable also sharing with the NSA.

Post by Kekcoin via bitcoin-devHmm, that's not the difference I was talking about. I was referring to the fact that using "post-chainsplit coinbases from the non-148 chain" to unilaterally (ie. can be done without action on the 148-chain) taint coins is more secure in extreme-adverserial cases such as secret-mining reorg attacks (as unfeasibly expensive they may be); the only large-scale (>100 block) reorganization the non-148 chain faces should be a resolution of the chainsplit and therefore render the replay threat moot.

If you don't have replay protection, replay is always a threat. A very serious one.

--Please do not email me anything that you are not comfortable also sharing with the NSA.

On Jun 6, 2017, at 5:19 PM, Kekcoin <***@protonmail.com> wrote:

Hmm, that's not the difference I was talking about. I was referring to the fact that using "post-chainsplit coinbases from the non-148 chain" to unilaterally (ie. can be done without action on the 148-chain) taint coins is more secure in extreme-adverserial cases such as secret-mining reorg attacks (as unfeasibly expensive they may be); the only large-scale (>100 block) reorganization the non-148 chain faces should be a resolution of the chainsplit and therefore render the replay threat moot.

Post by Kekcoin via bitcoin-devPlease read my email more carefully; the replay threat would be moot because there would be no alternative chain to replay the TX on,

In order to *get to that point*, you need >51%.

Not only that, but, if you started out with <51%, then you need >>51% in order to *catch up* and replace the large number of blocks added to the legacy chain in the mean time.

So, since >51% is _required_ for BIP148 to succeed (and likely >>51%)... you might as well do as SegWit did originally, or lower the threshold to 80% or something (as BIP91 does).

Without replay protection at the outset, BIP148, as far as I can tell, isn't a threat to miners.

--Please do not email me anything that you are not comfortable also sharing with the NSA.

Post by Kekcoin via bitcoin-devPlease read my email more carefully; the replay threat would be moot because there would be no alternative chain to replay the TX on, as the non-148 chain would have been reorganized into oblivion.Sent with ProtonMail <https://protonmail.com/> Secure Email.

Post by Kekcoin via bitcoin-dev-------- Original Message --------Subject: Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennableLocal Time: June 7, 2017 3:26 AMUTC Time: June 7, 2017 12:26 AMI don't know what you mean by "render the replay threat moot."If you don't have replay protection, replay is always a threat. A very serious one.--Please do not email me anything that you are not comfortable also sharing with the NSA.

Post by Kekcoin via bitcoin-devHmm, that's not the difference I was talking about. I was referring to the fact that using "post-chainsplit coinbases from the non-148 chain" to unilaterally (ie. can be done without action on the 148-chain) taint coins is more secure in extreme-adverserial cases such as secret-mining reorg attacks (as unfeasibly expensive they may be); the only large-scale (>100 block) reorganization the non-148 chain faces should be a resolution of the chainsplit and therefore render the replay threat moot.

I was merely describing that the only failure mode of using "post-split coinbases from the legacy chain" as seedcoins for cointainting purposes would be a resolution of the coinsplit, thereby rendering the cointainting redundant, therefore this would be an entirely safe approach to cointainting, as the only way coins could become untainted (and therefore subject to the threat of replay attacks) would coincide with a disappearance of the situation that gave rise to such replay attacks in the first place. This should sufficiently answer your concerns regarding lack of replay protection in case of medium-to-long-term chainsplits in general. If you fail to grok, please read again until you don't.

If you don't have replay protection, replay is always a threat. A very serious one.

--Please do not email me anything that you are not comfortable also sharing with the NSA.

On Jun 6, 2017, at 5:19 PM, Kekcoin <***@protonmail.com> wrote:

Hmm, that's not the difference I was talking about. I was referring to the fact that using "post-chainsplit coinbases from the non-148 chain" to unilaterally (ie. can be done without action on the 148-chain) taint coins is more secure in extreme-adverserial cases such as secret-mining reorg attacks (as unfeasibly expensive they may be); the only large-scale (>100 block) reorganization the non-148 chain faces should be a resolution of the chainsplit and therefore render the replay threat moot.

This is just me putting in my formal objection to BIP148 and BIP149 based on my experience with the ETH/ETC hard fork and involvement in that drama.

First, it's important to note that ETC/ETH HF is a very different situation from BIP148 and all other soft-forks. To those on this mailing list, the reasons should be self-evident (one results in two incompatible chains, the other doesn't).

However, replay attacks are common to both possibilities (i.e. when BIP148 has <51% hash power).

I believe the severity of replay attacks is going unvoiced and is not understood within the bitcoin community because of their lack of experience with them.

I further believe that replay attacks are the #1 issue with BIP148, BIP149, etc., superseding wipeout attacks in severity.

These are not baseless beliefs, they're born out of experience and I think anyone will reach the same conclusion upon study.

In a nutshell, replay attacks mean that all talk of there being potentially "two coins" as a result of BIP148 is basically nonsense.

Replay attacks effectively eliminate that possibility.

When users go to "sell their legacy coins", they've just sold their 148 coins, and vice versa.

Both of the coin-splitting techniques given so far by the proponents BIP148 are also untenable:

- Double-spending to self with nLockTime txns is insanely complicated, risky, not guaranteed to work, extremely time consuming, and would likely result in a massive increase in backlogged transactions and increased fees.

- Mixing with 148 coinbase txns destroys fungibility.

Without a coin, there is no real threat from BIP148. Without that threat, there is no point to BIP148, and the miners know this.

These and other concerns are outlined and explained in more detail in this conversation I had yesterday with John Light:

http://youtu.be/33rL3-p8cPw http://youtu.be/33rL3-p8cPw

Cheers,Greg Slepak

--Please do not email me anything that you are not comfortable also sharing with the NSA.